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ABSTRACT 

A  complex  system  envisioned  can  accomplish  a  given 
mission  with  the  aid  of  any  one  of  several  alternative 
structures.   Each  of  these  alternative  structures  (subsys- 
tems) ,  although  capable  of  mission  accomplishment,  exhibits 
different  levels  of  performance  due  to  its  component  inven- 
tory.  The  structures  are  ordered  in  preference  accordingly. 
Operation  on  less-preferred  structures  is  a  function  of 
component/structure  failure  histories  in  prior  structures. 
Failures  are  classified  by  three  levels  of  severity.   A 
system  effectiveness  model  is  developed  to  provide  a  measure 
of  effectiveness  for  the  overall  complex  system  which  encom- 
passes all  possible  alternative  structures. 
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CHAPTER  I 
INTRODUCTION 

In  light  of  the  present  day  advancing  technology,  sys- 
tems have  become  vastly  complex.   Coupled  with  this  rise  in 
complexity  has  been  a  gradual  increase  in  component  and 
system  size,  weight  and/or  cost.   The  rise  in  complexity  in 
just  avionics  systems  over  the  12-year  period  between  1953 
and  1965  has  been  by  a  factor  of  74,  not  to  mention  the  ex- 
pected complexity  factor  of  160  times  the  1953  avionic  sys- 
tem for  the  year  1968.  [l]  None-the-less  these  new  complex 
systems  cannot  always  incorporate  redundant  components  or 
subsystems  due  to  size,  weight,  and/or  cost  constraints; 
this  is  particularly  true  for  an  aircraft.  However,  there 
may  exist  a  less-sophisticated  component  or  group  of  com- 
ponents that  can  perform  the  same  (or  similar)  function  as 
a  complex  component,  but  somehow  in  a  less  effective  manner, 
e.g.,  solution  time  longer,  greater  uncertainty  in  solution, 
or  lower  probability  of  success.   This  less  effective  group 
of  components,  "alternative  structure",  can  also  accomplish 
the  mission  and  thereby  improves  the  overall  system  effec- 
tiveness by  a  new  form  of  redundancy,  since  the  usual  form 
of  redundancy  implies  equal  effectiveness. 

The  foregoing  concerning  complex  systems  and  associ- 
ated constraints  applies  most  assuredly  to  military  weapons 
systems  being  contemplated  for  aircraft,  ship  and  submarine 
platforms  of  the  future. 


I.  PURPOSE  OF  THE  SYSTEMS  EFFECTIVENESS  MODEL 

In  spite  of  the  enormous  complexities  and  the  size, 
weight  and/or  cost  constraints,  a  weapons  system  must 
still  achieve  a  high  mission  reliability,  usually  in  the 
high  nineties,  where  mission  reliability  is  defined  to  be 
"the  probability  of  adequate  system  performance  for  the  du- 
ration of  the  mission  in  the  usual  mission  environment." 
In  this  paper  adequate  system  performance  will  imply  that 
at  least  one  alternative  structure,  i.e.,  a  subsystem  ca- 
pable of  mission  accomplishment,  remains  operable.   An 
operable  structure  by  definition  experiences  only  repair- 
able type  (minor)  failures  during  a  mission. 

The  problem  is  to  develop  a  model  to  measure  the  over- 
all system  effectiveness  which  incorporates  the  effects  of 
availability, conditioned  effectiveness  and  the  component/ 
structure  failure  degradation  over  all  admissible  alterna- 
tive structures.   The  measure  of  system  effectiveness 
derived,  hopefully,  will  approximate  the  "systems  perform- 
ance effectiveness"  defined  as  "a  measure  of  the  extent  to 
which  a  system  can  be  expected  to  complete  its  assigned 
mission  within  the  time  frame  under  the  stated  environment- 
al conditions."  [2] 

II.  SIGNIFICANCE  OF  THE  MATHEMATICAL  MODEL 

The  United  States  Navy  currently  has  under  development 
several  new  complex  weapons  systems  to  cope  with  the  growing 
submarine  threat.   The  P3C  patrol  aircraft,  being  developed 
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by  Lockheed  at  Burbank,  California,  and  under  evaluation  by 
the  ASW  Projects  Office,  Washington,  D.C.,  is  one  such  weap- 
ons system.   The  revolutionary  weapons  system  incorporates 
a  variety  of  sophisticated  detection  sensors  in  a  complex 
computerized  system  design.   For  each  of  the  several  mis- 
sions of  the  P3C  aircraft,  there  exists  a  set  of  alternative 
structures  of  components  feasible  to  the  accomplishment  of 
that  mission.   The  ultimate  purpose  of  this  effectiveness 
model  is  to  obtain  a  quantitative  measure  to  be  used  in  de- 
sign alteration  comparisons  in  the  P3C  aircraft. 

The  alternative  structured  approach  for  the  P3C  air- 
craft seems  practicable  for  the  following  reasons:  (1)  by 
the  nature  of  the  aircraft/submarine  detection  and  tracking 
problem,  the  structure  most  effective  for  a  mission  may 
change  during  a  mission  engagement  as  a  result  of  environ- 
mental or  target  tactics,  and  (2)  by  reason  of  limited 
weight  and  space  requirements  aboard  an  aircraft,  a  failure 
may  occur  to  cause  an  operating  structure  to  be  inoperative 
(non-repairable)  for  the  remainder  of  the  mission.   Either 
of  these  reasons  necessitates  operation  on  another  alterna- 
tive structure,  usually  of  different  performance  and/or  re- 
liability. 

The  mathematical  model  developed  by  Zagor,  et  al.,  [3] 
for  computing  the  reliability  of  a  hypothetical  multi-model 
fire  control  system  treated  a  similar  system  redundancy 
variation.   In  the  Zagor  model  the  system  effectiveness  of 
a  three  mode  hypothetical  fire  control  system  was  formulated 
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accounting  for  mode  effectiveness  and  mode  likelihood.   The 
system  effectiveness  model  to  be  described  in  Chapter  II 
and  derived  mathematically  in  Chapter  III  takes  into  con- 
sideration three  levels  of  failure  severity  :   failures 
unacceptable  to  mission  accomplishment,  failures  permissi- 
ble but  non-repairable,  and  failures  permissible  and  repair- 
able. 
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CHAPTER  II 

DESCRIPTION  AND  FORMULATION  OF  MODEL 

A  particular  mission  of  a  complex  system  can  be  accom- 
plished by  any  one  of  several  alternative  structures  (sub- 
systems) of  the  system  components.   The  alternative  struc- 
tures are  composed  of  components  in  logical  series  and  are 
ordered  in  preference  by  their  attainable  degree  of  mission 
performance.   Component  failures  in  this  complex  system  are 
grouped  into  three  classes  of  severity,  namely  critical, 
major  and  minor  failures.   Component  failures  that  are  not 
allowable  in  the  accomplishment  of  the  mission,  and  as  such 
cause  mission  abort  when  they  occur,  are  defined  as  critical 
failures.  A  major  failure  is  one  whose  occurrence  precludes 
any  further  operation  with  the  associated  structure  during 
mission,  i.e.,  forces  a  shift  to  a  lower  priority  structure, 
and  may  result  in  degrading  the  effectiveness  of  an  alterna- 
tive structure.   Component  failures  repairable  during  a  mis- 
sion by  on-board  repair  parts  are  defined  as  minor  failures. 
Minor  failures  degrade  structure/system  effectiveness  (per- 
haps proportional  to  structure  down-time  or  function  lost) 
but  do  not  require  a  shift  to  another  alternative  struc- 
ture.  This  model  establishes  a  functional  relationship  to 
quantify  the  overall  system  effectiveness  taking  into  con- 
sideration the  various  performance  levels  and  reliabilities 
of  all  mission-orientated  alternative  structures. 
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The  primary  or  priority  one  alternative  structure  is 
that  structure  capable  of  obtaining  the  greatest  degree  of 
mission  performance  due  to  its  sophisticated  component  de- 
sign.  The  priority  one  structure,  S, ,  may  in  a  particular 
system  include  all  components  of  the  system.   However,  this 
is  usually  not  the  case  since  most  complex  systems  incorpo- 
rate redundant  components  (components  that  will  perform  the 
same  function)  having  a  lower  performance  capability.   The 
performance  of  the  priority  one  structure  in  a  failure-free 
environment  is  primarily  a  function  of  three  variables, 
namely :  (1)  the  state  of  the  art  in  component/system  engi- 
neering design,  (2)  the  environmental  operating  factors  en- 
countered during  a  mission,  and  (3)  the  component  operator's 
state  of  training  and  performance  levels.   However,  there 
exists  some  average  level  of  effectiveness,  E?  ,  realized 
when  operating  the  system  utilizing  the  primary  structure 
S,  in  a  failure-free  environment.   But  when  failures  occur, 
structure/system  effectiveness  becomes  degraded. 

For  a  particular  mission  a  complex  system  has  the  set 

of  admissible  alternative  structures  {s.,  j  =  1,2, ».°,  j} 

ordered  in  preference.   Each  alternative  structure  S.  has 
*  3 

associated  with  it  the  sets  of  components  susceptable  to 
critical,  major  and  minor  failures,  i.e.,  & .  „    %..    and  $C. 
respectively,  where 


3 


*j  =  ^Cjl<  Cj2<  •••  '  Cjg'  •••  •  CjG 


3         L  Dl   32  '   ]k'        dK. 


3 
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Kj    =    \mjl'  mj2 mj£ mjL 

and  C.^,  M.#,  m . ,  represent  the  events  of  critical,  major 
and  minor  failures  in  structure  S.,  respectively.   Similar- 
ly, X.  #  X.^,  X.^   and   t .  ,  t.k#  t.A   correspond  to  the 
component  failure  rates  and  operating  durations  for  the 
components  in  & . ,  #?.  and  K.,  respectively.   The  effective- 
ness of  a  system  experiencing  a  critical  (abort  type)  fail- 
ure will  be  by  definition  equal  zero.   The  major  failures 
are  those  failures  which  are  non-repairable  during  the  mis- 
sion and  which  force  system  operation  into  an  alternative 
structure  of  less  desirable  performance.   This  less  effect- 
ive structure  is  also  susceptible  to  degradation  from  the 
major   failure(s)  in  prior  structure (s) .   Let  the  degrada- 
tion factor,  D.,   .  ,  ,  be  defined  as  the  degradation  factor 
on  structure  S.,n  resulting  from  event  M.,  in  structure  S.. 
Minor  failures  also  connote  a  degrading  effect,  but  the  de- 
gradation factor  is  applied  to  present  structure  effective- 
ness.  Now  d.  .  .  denotes  the  degradation  factor  on  struc- 
3  *#  3 

ture  S.  due  to  the  event  m .  „  in  S..   Several  assumptions  are 
now  made  about  the  component  failure  distributions. 

Independent  exponential  failure  time  distributions  are 
assumed  on  all  components  and  on  all  subassemblies  whose 
failure  is  a  critical,  major,  or  minor  event.   The  failure 
rate,  X,  of  a  component  is  the  same  regardless  of  the  alter- 
native structure  in  which  it  is  operating.   The  failure 
rates  of  components  in  non-operating  states  are  equal  to 
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zero.   If  a  particular  component  in  the  system  is  suscept- 
ible to  more  than  one  class  of  failure,  then  that  component 
will  be  subdivided  into  pseudo  components  affected  by  only 
one  class  of  failure  for  ease  of  formulation  of  the  model. 
The  effect  of  failures  on  mission  performance  will  now  be 
considered. 

From  the  preceding  discussion  of  failure  types  and  con- 
sidering a  particular  system  design,  one  can  enumerate  the 
success  paths  (system  failure  histories)  such  that  the  mis- 
sion will  still  be  accomplished,  but  degraded  in  varying 
amounts  by  the  effects  of  associated  failures.   To  obtain  a 
quantified  measure  of  effectiveness  that  incorporates  the 
flexibility  in  performance  and  reliability  in  an  alterna- 
tive structured  system,  the  system  effectiveness  model  is 
formulated  below  encompassing  all  possible  success  paths  in 
the  accomplishment  of  the  mission. 
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CHAPTER  III 

SYSTEM  EFFECTIVENESS  MODEL  DERIVATION 

Mission  accomplishment  is  associated  with  the  greatest 
system  effectiveness  when  no  critical  or  major  failures 
occur  during  the  mission  duration  (0,T) .  In  this  particular 
"success  path",  i.e.,  no  failure  in  the  primary  structure 
S  ,  the  overall  system  effectiveness  is  the  product  of  E, 
(the  average  effectiveness  of  structure  S,  accounting  for 
minor  failure  degradation  effects)  times  the  probability  of 
no  critical  or  major  failures.   Let  RC.(t)  and  RM.(t)  be 
respectively  the  probability  of  no  critical  and  of  no  major 
failures  in  structure  S.  during  time  (o,t).   Then,  if  only 
one  structure  existed  for  a  particular  system,  the  system 
effectiveness  would  be 

E  =  E.,  x  RC,(T)  x  RM,  (T). 

However,  in  the  complex  system  envisioned  here,  there  are 
several  alternative  structures  feasible  to  the  accomplish- 
ment of  mission,  and  the  alternative  structures  are  utiliz- 
ed when  preferred  structures  fail.   As  such,  system  effec- 
tiveness must  account  for  this  incremental  effectiveness 
obtained  via  alternative  structures  when  these  same  struc- 
tures are  probable. 

The  formulation  of  such  a  model  accounting  for  the 
effectiveness  of  all  alternative  structures  weighted  by 
each  structure's  probability  of  being  utilized  follows: 
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as 


System  Effectiveness  on  Mission  m  (E  )  is  modeled 

J  m 


E   =  E,  x  RC-.  (T)  x  RM,  (T)  +   )  E.  P.  ,  (1) 

j=2 


where 


and 


RC,  (T)  =  Probability  of  no  critical  failures  in  S., 
during  mission 

=   eXP     -  I       Xlg  fclc 

\g=i 

RM, (T)  =  Probability  of  no  major  failures  in  S,  during 

mission 

K-, 


exp    -  I     X        t 


Ik  "Ik 
k=l 

E.      =  Average  structure  S.  effectiveness  accounting 

for  degradation  from  major  failures  in  prior 

structures  and  degradation  from  minor  failures 

in  S  . 
D 


P 


=  Probability  structure  S,,  S2*  . . » »  S.  each 
experience  a  major  and  no  critical  failure, 
and  S.  ,  experiences  no  major  or  critical 
failures  in  (0,T)  ' 

i  Accounts  for  all  (J)  admissible  alternative  structure 
effectiveness  given  the  structure  is  reliable* 

During  mission  hereafter  denoted  by  (0,T) . 
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Now  E-  is  obtained  in  the  following  manner.   First  of 

all,  it  is  assumed  that  the  effectiveness  of  performance 

level  of  any  particular  alternative  structure  given  no  fail- 

ures,  defined  as  E .  ,  is  known  or  may  be  estimated  by  Opera- 
nt 

tional  exercises.   The  E.  represents  the  nominal  structure 

3 

S .  effectiveness  for  the  current  state  of  the  art,  the  en- 
3 

vironmental   operating  factors  encountered,  and  the  opera- 

•k 

tor  performance  level  as  discussed  previously.   But  E.  must 

account  for  (i.e.,  be  degraded  by,  when  appropriate)  the 

effect  of  major  failures  in  prior  structures  S, ,  S~,...,S._, 

on  structure  S..   Letting  D.,   .  be  the  degradation  factor 

on  S.  from  the  first  major  failure  M.,  in  structure  S.,  for 
j  J  lk  i 

i  <  j,  it  follows  that 

j-1   Ki 

E  .'  =  E*   )    )  D.,   .   (probability  first  major  failure 
3  3    i=l  k=l  *  ' :  in  Si  is  Mik 

y  y  d,v  .  /  v  ik 


j  L       L   Dik,j  [   k± 


i=l  k=l 


k'=l 


wh 


ere  EJ  is  identically  E,  ,  and 


E  .'  =  Average  effectiveness  of  S.  accounting  for  major 

failures  in  structures  S,  ,  S0,  ...,  S.  -.   . 

1    2         j-1 


'  When  a  major  failure  has  no  degradation  effect  on  a 
structure,  then  the  degradation  factor  is  zero. 


19 


where  the  term  in  parentheses  above  is  derived  in  Appendix  A. 

A  particular  alternative  structure  S.  effectiveness 
should  also  take  into  consideration  the  several  success 
paths  under  various  minor  failure  histories  within  that 
structure.   Therefore  a  weighted  average  of  the  E .'  ,    defin- 
ed above,  where  the  weights  are  the  products  of  the  various 
probabilities  of  minor  failure (s)  and  the  associated  minor 
failure (s)  degradation  seems  plausible  for  an  average  struc- 
ture effectiveness  E.  capability.   Formulating  the  above  we 
obtain,  assuming  independent  exponential  distributions,  the 
following: 


E.  =  E  .*  ^Probability  no  minor  failures  in  S.  in  (0,T). 

,    „  ,  \  /",      "\   /Prob.  m .  , ,  occurs\  /  Prob,  no  other 

* ,  _-,  Vin  S.  in  (0,T)    I  \    minor  failures  m^ 

in  (0,T) 

b 


3  , .  ,   fr  , 3l  '3yv^  .is/  and  m        \  /  0 


Prob .  no 
v=i    r=i  /  —  ~j!-   "  ~ther  minor> 

l"  >  V  1   occur  in    \\      failures  in 


\S.  in  (0,T)/  \S.  in  (0,T] 


+    c   (small  order  terms) 


Inserting  the  probabilistic  results  derived  in  Appendix  B, 

t 

it  follows  that 


A  more  conservative  approximation  would  be  obtained  by 

replacing  t . .    in  the  first  term  by  T;   also  simplifying 

J  ^ 
calculations. 
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E.     =    E  .' 


i=± 


X • „t . , 


L. 

+  e:    )  (d. ,,    . 

jfc'=l 


L.  L. 

D  D 


-    e 


r=i 


+  E. 


Kdji\jXdJr,j 


1-e 


+  e  (small  order  terms)  • 

Simplification  to  the  calculation  of  the  E.  terms. 
L-  3 

when  the  Jr    X .      exponent  terms  are  small,  would  be  to  use 


approximation 


-rv 


l-e 


je=i 


i3. 


V  + 

jg=i  • 


j?=i 


s*T 


+ 


discarding  the  higher  order  terms  when  input  data  shows 
them  to  be  insignificant. 

P.,  the  probability  that  structures  S-.  ,  S~,'**,  S. 
each  experience  a  major  and  no  critical  failure,  and  struc- 
ture S.  ,  experiences  no  major  or  critical  failures  in(0,T) 
is  obtained  as  follows.   Let  Y.,  be  the  minimum  |t,,,  ,T  .,2». . ./ 


T.,„    where  T.,,  is  the  time  to  event  M.,,   (major  failure 

3  K  .  ,  J  J     K   .  J     K 
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event  in  S.,),  then  Y.,  represents  the  time  to  first  major 
failure  in  S . ,  .   Now  define 


e.    =    ;y., 


j'=l 


as  the  "time  for  a  sequence  of  major  failures  in  structures 


Sl'  S2 


,  S."',  with  the  assumption  of  zero  switching 


time  between  alternative  structures.   Let  fy  (t)  be  the  pro- 

J 
bability  density  function  of  the  time  for  a  sequence  of 


major  failures  in  structures  S1 ,  S~, 


Thus 


P.  =  Prpb, 
3 


S1#S2,...,S.  fail  major, 

S, ,S~/ . . . ,S  .  not  fail  critical, 

S.  t  not  fail  major  for  remainder  of  mission, 
3+1  J 

S.,,  not  fail  critical  for  remainder  of  mission/ 

:+i  / 


and 


P.  = 
3 


fs  (t) 

o   j 


RC  .  ,  ( t) 
j'=l    3 


RM.  n  (T-t) 


RCj+1(T-t) 


dt 


where 


fE  (t) 


(X.)jtj 

r(j) 


-x.  t 

.  3 


3    =   l^2. 


J-l 
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is  a  gamma  P.  D.F.  [4]  ,  where  equal  structure  X.  (mean  time  to 
first  major  failure  is  assumed)  is 


K. 


X        =      X 


1      ' 


where  X 


-  I 


k=l 


X-u 

3* 


X       =      (X     +   X   )/2 


X        =      (X1   +   X2   +    ...    +   X.)/j 


j  j 

Assuming    that]  RC.,(t)    =1  RC  .  ,  (T)  ,    then   Eq.     (5) 

becomes 


j"=i      D 


"V 


="TTrc.,(t) 

i'=l      3  JoL 


Tr(X.)^    t^"1         -fijfl 


r(j) 


a 


K 


-  £**-*» 


k=l 


r 


G. 


-Yx.    (T-t) 

L  39 


g-i 


dt 


(6) 


Examining  Eq.  (6)  for  a  few  small  j  values,  we  obtain 


-  i  x,  t 


P]=e 


g=l 


lg  lg 


i-G 


r 

o 

G 


-X,t 
X,  e 


i—     K, 


-   IX       (T-t) 


1 


r 


k=l 


"  IW^ 


1 


g=l 


dt 


K2        -, 


1  °2 

IXlatla+    IX2aT+    IX2kT 


lg=l 
=e    r 


lg   lg        Z_T2gA        ^'v2k 
g=l  k=l 


'     X  n  e 
o      1 


r     K 


G2        -| 


*1    "ZX2k    "  I  X 

L      k=l  g=l       -1 


2g 


dt 
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-Dl  f  ,  -Flfc  .„ 

=  e        A,e      dt 
'  o 


where 


Dl  = 


Gl  G2         *2 

I  Wig   +  I  X2gT  +  I  X2kT 
g=l         g=l       k=l 


F   = 
1 


K. 


h  -  2> 


^2 

2k      L   X2g 
k=l       g=l 


Then  it  follows  that 


i—     K. 


"D2 
P2    =    e         -, 


(X2)    t  ->2t 


r(2) 


-ZX3k(T-t) 


k=l 


r  P     i 

LX3g(T-t) 

,  g=i 

J 


dt 


K. 


■D0   PT  _ 


=   e 


(xa,»f.-^-^x 


3k  Z_,  3g 


JL    it 


k=l  g=l 


dt 


-D, 


=    e 


(X2)Z    t   e      Z      dt 


24 


where 


~    G. 
2     i 


~1  "2 

D  '  =   /  L  t,   +  }  X„  t„   =   )  )  X.  t. 

2     L  lg  lg  Li      2g  2g  Z_.  Z_.   ig  ig 

g=l  g=l  i=l  g=l 


G3         K3 


D2  =   D2  +   1  X3gT  +   A  X3kT 


g=l       k=l 


K3       G3 

F2  =   X2  ~   1  X3k  "   1  X 


3g 


k=l 


g=l 


Similarly  we  obtain   P., 


P3  =  e 


-D.  pT    (X  )3  t2   -Ft 

e   J   dt 


ro) 


Each  of  the  integral  expressions  in  P.. ,  P»  and  P  may  be 
transformed  into  incomplete  gamma  functions  (P,  degenerates 
into  an  exponential  function)  as  follows 


P      =   e 


-D1     pT  -P,  t 


1-    ..  "Dl   (   Xl 

xie        dt  =  e      ky: 

o  1 


T 


F,e  dt 


-D, 


P2   =   e 


T  _        2        T 

-      2  "F2fc                   ~D2     (X2} 

(X9)       te  dt   =   e  7? 

o  ,J              (For    °o 


-F    t 
2  2 

(F2)     te       Z      dt 
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P3    =   e 


rT  (F3>3t2    -F3fc 
.     ro)    e        dt 


-D, 


=  e 


3  ^3 


ro) 


e    ds 


The  latter  is  obtained  by  the  substitution,  s  =  F^t. 

The  Incomplete  Gamma  Function  is  evaluated  from  Incom- 
plete Gamma  tables  or  readily  from  Poisson  tables,  after 
using  the  following  well  known  identity  (See  Appendix  C)  .[5] 

(i) 


Xt)J 

r(j) 


dt  =  I   (itr e 


For  example 


1=3 


-D, 


P3  =  e 


"  (F^)1   -F3T 
-n e 


I 


i=3 


Now  that  all  terms  of  equation  (1)  have  been  formula- 
ted, each  may  be  evaluated  with  proper  input  and  inserted 
in  Eq. (1)  to  give  a  quantitative  measure  of  overall  system 
effectiveness . 
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CHAPTER  IV 
SUMMARY  AND  CONCLUSIONS 

I .   SUMMARY 

"The  effective  performance  of  Navy  systems  in  fleet 
use  is  essential  to  successful  Navy  operations."  [l]  The 
alternative  structure  concept  of  a  complex  weapons  system 
seems  to  have  merit  in  the  improvement  of  '-' system  perfor- 
mance effectiveness."  The  P3C  aircraft  contains  a  complex 
system  that  is  recognized  to  have  such  a  structure  due  to 
the  nature  of  its  mission. 

In  the  preceding  chapters  a  complex  mission  oriented 
system  composed  of  a  set  of  ordered  alternative  structures 
(any  one  of  which  are  capable  of  mission  accomplishment) 
was  described.   The  preference  ordering  of  structures  was 
assumed  to  be  by  performance.   Failures  of  components  of  a 
structure  were  classified  into  one  of  three  levels  of 
severity:   critical,  major  or  minor  failure.   The  effects 
of  failures  on  system  effectiveness  were  accounted  for  by 
degradation  factors,  such  that  a  critical  failure  caused 
total  degradation  or  mission  abort,  a  major  failure  comple- 
tely degraded  the  current  structure,  and  a  minor  failure 
(repairable)  partially  degraded  the  current  structure. 

A  mathematical  model  for  the  above  system  design  was 
then  developed  to  obtain  a  quantitative  measure  of  the  over- 
all system  effectiveness  reflecting  the  capability  or  multi- 
ple success  paths  admissible  in  the  accomplishment  of  a 
particular  mission. 
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II.  CONCLUSIONS 

Several  assumptions  and  approximations  (presumably- 
conservative)  were  made  in  obtaining  a  closed  form  solution. 
In  any  application  of  the  model  the  assumptions  and  limita- 
tions must  be  considered.   First  of  all,  the  model  applies 
to  a  specific  kind  of  system  design.   The  measure  of  effec- 
tiveness obtained  from  the  model  can  only  be  as  good  as  the 
input  data;   consequently,  failure  rates,  performance  and 
degradation  factors,  etc,  should  be  revised  to  reflect 
current  knowledge.   If  independent  exponential  failures 
cannot  be  assumed,  then  the  model  must  be  modified  or  used 
with  discretion.   When  the  assumption  can  be  accepted,  this 
model  affords  a  straight-forward  solution  with  the  proper 
input  paramters, 

III.  ADDITIONAL  RESEARCH 

Further  research  effort  is  needed  to  test  the  model 
(for  example  by  simulation  techniques)  for  its  sensitivity, 
with  current  P3C  design  parameters.   While  this  model  treats 
a  major  failure  as  a  trigger  to  cause  a  shift  in  alterna- 
tive structure,  the  model  could  be  altered  to  address  the 
problem  of  a  structure  shift  due  to  a  target  tactical  ma- 
neuver.  This  preliminary  model  when  validated  could  by 
simulations  provide  insight  into  the  effects  of  changing  on- 
board repair  parts  and  altering  a  component  structure  fail- 
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ure  severity  by  incorporation  of  redundant  components.   In 
this  way,  design  revision  results  in  terms  of  "system  per- 
formance effectiveness"  could  be  quantified  for  decision 
purposes. 
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APPENDIX  A 


1.   Derivation  of  Probability  f  First  major  failure 

in  S.  is  M., 

1      lk 


Let   T.,   =   the  random  variable  time  to  major  fail- 

lk  J 

ure  M.,  . 
lk 


Tik  ~  exP<Xik> 


V     =   Min      T.v, 

l^k'^K.   1K 

1 


(Wk) 

then 

P  (Ti;L>t)  P  (Ti2>t)  •  •  •  P  (TiK  ±>t) 


1  -  F_7(t)  =  prob.  (V>t)  = 


vw      ^v«.,v'W  p(T      >t) 

ik 


and  K 

i 

fv(t)   =   ^.e^k^   where    X^ ,  ■  I  \^ 

k'=l 

k'^k 


Now 


Prob.  |  First  major  failure!   =   Prob.  (^T.,  <  V 


in  S.  is  M., 
l      ik 
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-X_.n.T,,_  p00     ~V'V 


ik  ik 


Xike         J  X^.e   ^   dVdT 


o  T., 

ik 


r       -(x.,   +  x    )Tik 

X..e    1K     K      dT.- 
lk  ik 

o 


ik 


Xik  +  Xk' 


ik 


K. 

1 


k'=l 
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APPENDIX  B 

1.   Derivation  of  Probability  /  No  minor  failures 

in  S .  in  (0,T) 

: 

Let      X. „  =   the  random  variable  time  minor  failure 

X..,  t.  .    =      failure  rate  and  operation  duration  of 
the  component  t   in  structure  S. 

Prob.  (  No  minor  failures 
in  S  .  in  (0,T) 

=      Prob.    (x.    >t.„;       for   all    1    <■   I    ^   L. 

=     exp     I  -  ^Xj£tjx 

1=1 


2.      Derivation   of   Prob.  /m  .  ,  ,    occurs!    Prob. |    No   other  minor] 

in   S .  1  V     failures    in 

in    (0,T)      /  \     S  .    in    (0,T)' 


=      Prob-.Tx.  „  ,<  T)Prob.    UVLin     X  .    >T  ) 


L.  ^' 


1    -   e 


3.   Derivation  of  Prob.  /  m. .  .  %  ,    m.,„  \  Prob.  /No  other  minor 

occur  in    I       \  failures  in 
kS.  in  (0,T)/        \  S.  in  (0,T), 
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follows  similarly  and  is  given  by 


L. 
3 


_e-VT 


1  -  e  3!i 


1=1 
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APPENDIX    C 


lm    show    rT  lAuTi  e-xt  dt  .   y  ixni  e-xT 

i=j 

where   X  is  the  mean  rate  of  occurrence  of  failures. 

Let   F.(T)   =   Probability  that  the  time  to  occurrence 
D 

4-Vi 

of  the  j  major  failure  event  will  be 
less  than  T ( represented  by  the  term  on 
left  of  the  identity  above) . 

then,  1  -  F.(T)   =   Probability  that  the  time  to  occurrence 

of  the  j    major  failure  event  will  be 


greater  than  T, 


and  equivalently 


1  -  F.(T)  =  Probability  that  the  number  of  major 
failure  events  in  the  time  0  to  T  is 
less  than  j . 

Since  the  major  failure  events  are  happening  in  accordance 
with  a  Poisson  probability  law  with  an  assumed  mean  rate  X, 
it  follows  that 

j-l 

-XT 


i  -  Pj(t)  =   Y,  r. (XT)i 


e 

i:  ' 

i=0 


or 


CO 

F.  (T)   -    7  T7  (XT)1  e' 

i—>      l. 


-XT 
i  =  D 
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Therefore 


n  1M1 


j-i 


r(j) 


e  dt 


s     Z4r   (XT)i  e_XT 


i=D 
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